Tight bound on coherent states quantum key distribution with heterodyne detection 
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We propose a new upper bound for the eavesdropper's information in the direct and reverse 
reconciliated coherent states quantum key distribution protocols with heterodyne detection. This 
bound is derived by maximizing the leaked information over the symplectic group of transformations 
that spans every physical Gaussian attack on individual pulses. We exhibit four different attacks 
that reach this bound, which shows that this bound is tight. Finally, we compare the secret key 
rate obtained with this new bound to the homodyne rate. 



I. INTRODUCTION 

Continuous variable quantum key distribution 
(CVQKD) is an alternative to single photon "discrete" 
QKD that encodes key information in variables with 
a continuum of degrees of freedom. Such variables 
include the quadratures X and P of a mode of the 
electromagnetic field. A CVQKD protocol using these 
quadratures has been introduced in [1]. It consists in 
sending a train of pulsed coherent states modulated in 
X and P with a Gaussian distribution (Alice's module), 
and in quadrature measurements with an homodyne 
detection upon reception (Bob's module). Then, Bob's 
continuous data are used as the basis for constructing 
a secret binary encryption key, in a classical informa- 
tion process called "reverse reconciliation" (RR). The 
security of the RRCVQKD homodyne protocol has first 
been proven against individual Gaussian attacks T| , and 
later extended to individual or finite-size non-Gaussian 
attacks More recently, new security proofs covering 
collective, Gaussian and non-Gaussian attacks [3, [J 
have appeared. 

In the homodyne protocol pj. Bob randomly chooses 
to measure either X or P, and then announces his choice. 
Another possible approach, proposed in 0] by Weed- 
brook and co-workers, is that Bob measures both X and 
P quadratures of each incoming coherent state, by sepa- 
rating them on a 50-50 beam-splitter Tb- This detection, 
called "heterodyne" is represented in Fig. [1] Notably, in 
this protocol. Bob does not need to randomly switch his 
measurement basis. 




FIG. 1: Heterodyne protocol. Bob measure both quadratures 
X and P of the incoming mode B' . A generic eavesdropping 
strategy involves a transformation S on Alice's mode and two 
vacuum ancillary modes. 



In the authors proposed a bound on the informa- 
tion acquired by the eavesdropper (Eve) in the hetero- 
dyne protocol, under the hypothesis of individual Gaus- 
sian attacks. They also considered a possible attack 
based on feed- forward (see below for details), that they 
however found to be suboptimal with respect to their 
proposed bound. Therefore, a gap remained between the 
apparently most stringent bound and the best known at- 
tack, which is surprising in the simple scenario of individ- 
ual Gaussian attacks. Later on, in 6j, the same authors 
conjectured that their proposed attack is indeed optimal, 
and so that tighter bounds should apply to Eve's infor- 
mation. However, no such tighter bound was proposed 
so far. 

In this article, we propose a new bound for individual 
Gaussian attacks on the CVQKD heterodyne protocols, 
tighter than the bound of [5|. In addition, we explic- 
itly present a series of attacks which are optimal with 
respect to this bound, closing the gap between the best 
known attacks and the tightest known bound. The ar- 
ticle is organized as follows: after introducing notations 
in section ini the new bounds are derived in section [1111 
In section IIVI we extend the technique used to estab- 
lish these bounds to obtain new results about the homo- 
dyne protocols. Specifically, we will show that any ho- 
modyne attack using quantum memory is optimal, and 
that in some cases this optimality can be reached without 
quantum memory. Section |V] is devoted to another tech- 
nique, based on symplectic invariants, which allows us 
to derive again the new heterodyne bounds from another 
point of view. Then section IVII describes four optimal 
attacks with respect to the new heterodyne bound, and 
section I VIII concludes our study by discussing practical 
advantages of the heterodyne protocol. 



II. NOTATIONS 

In the case of Gaussian attacks, the channel linking 
Alice to Bob is fully characterized by its transmission in 
intensity T (possibly greater than 1 for amplifying chan- 
nels) , and its excess noise e above the shot noise level 0] , 
such that the total noise measured by Bob is {l+Te)No, 
where Nq is the shot noise variance appearing in the 
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Heisenberg relation {X'^){P'^) > Nq. Alternatively we 
will make use of the total added noise referred to the in- 
put X defined by x = 1/T+e— 1. These parameters might 
depend on the quadrature considered, in which case we 
will add a subscript indicating this quadrature {e.g. Xp)- 

The quantum channel is considered to be probed 
by Eve with the help of ancillary modes. To index 
these modes, we will note Xm and Pm the quadra- 
tures of mode M, and write down the 2n quadra- 
tures of n modes Mi , . . . , M„ by the vector Q = 
{Xmi , . . . ,Xm„, Pmi , Pm„ ) ■ The total Gaussian 
state of the system is then represented by its covariance 
matrix 7 of components = (QiQj). 

In the heterodyne protocol, we note B the modes mea- 
sured by Bob, and B' the incoming beam, on which we 
will base our demonstrations. This mode is coupled with 
two ancillas on which Eve respectively measures X and 
P (Fig. [1]). In [5j, the authors bounded the conditional 
variance Vx^iIXe^ ^^'^ Vpbi\Pe2 mode B' knowing 

Eve's measurement results by 
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where iV — l)iVo is Alice's modulation variance. This 
is basically the homodyne RR bound derived in [l|, Q 
applied to each quadrature X and P. 

Assuming that Eve does not control the beam-splitter 
Tg, this bound then leads to the minimal conditional 
variance of mode B knowing Eve's measurement by 
adding the shot noise unit and the intensity decrease in- 
troduced by the beam-splitter T^: 
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Then the information acquired by Eve results from Vb\e 



Ibe = 2 X ^ log2 



V, 



B\E 



With Vb = ^^^V^ + Vo, 



where the factor 2 reflects the double quadrature mea- 
surement. A similar reasoning on Iab finally gives the 
secret rate A/ = Iab — Ibe- This rate is shown to be 
greater than the homodyne rate for any channel parame- 
ter, giving advantage to the heterodyne detection scheme. 

Several explicit attacks against the heterodyne proto- 
col have been considered. In Q, the authors propose 
an eavesdropping strategy based on heterodyne measure- 
ment and feed- forward (Fig. ^l), which they numeri- 
cally show to be suboptimal with respect to bound ^ . 
In [sl, Namiki et al. introduce an eavesdropping strat- 
egy against the homodyne RRCVQKD protocol based 
on a cloning machine (Fig. [21-2). In this attack. Eve 
can measure both X and P quadratures of each coher- 
ent state, then requiring no quantum memory. The price 
to pay is that this attack is no more optimal with re- 
spect to the homodyne bound (H]). In fact, the search 
for quantum-memory-less homodyne attacks is very sim- 
ilar to finding attacks on the heterodyne protocol because 
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FIG. 2: Our general results are illustrated by considering four 
optimal attacks against the heterodyne protocol. In the feed- 
forward attack (1), Eve taps a fraction 1 — Te of the signal 
on which she makes an heterodyne measurement. Then she 
translates Bob's quadratures according to her measurement 
results modified by a gain qe. In the cloning attack (2), Eve 
amplifies the signal sent by Alice with a phase insensitive am- 
plifier, and taps the amplified beam. Quantum teleportation 
(3) consist in a making the incoming beam interfere with a 
part of an EPR pair. X and P are measured in the output 
arms of the interferometer. Bob's quadratures are then trans- 
lated according to Eve's results. Finally, in the entangling 
doner attack (4), Eve tap a fraction 1 — Te of the incoming 
signal, while introducing some excess noise with the help of 
an EPR pair. The joint measurement of the tapped signal 
and the other part of the EPR pair optimally exploits both 
tapped signal and EPR noise correlations. 



both schemes require that Eve measures X and P on each 
channel symbol. Therefore, the cloning attack is yet an- 
other sub-optimal attack against the heterodyne protocol 
when considering bound ([T]). We shall prove in this ar- 
ticle that these two attacks are optimal with respect to 
the new bounds we derive for the heterodyne protocol, as 
well as two other attacks based on EPR entanglement. 



III. NEW BOUNDS BASED ON THE IWASAWA 
SYMPLECTIC DECOMPOSITION 

To derive the new bounds on heterodyne detection pro- 
tocols, we will use the symplectic formalism which de- 
scribes all physically possible Gaussian individual trans- 
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formations on a set of n modes. The real symplectic 
group is defined by the set of linear transformations of 
the quadrature vector Q, which 2nx 2n matrix S satisfies 



S(3S^ = (3, with (3 



I„ 
-I„ 



(3) 



where I„ is the n x n identity matrix. The main idea 
of our demonstration is to use a proper parameterization 
that spans all symplectic transformations applied to the 
modes going through the quantum channel, hence all pos- 
sible attacks, and to compute the best information Eve 
can obtain when these parameters vary. 

The real symplectic group is a n{2n + 1) parameters 
space for which various parameterizations - or decom- 
positions - exist. We choose the Iwasawa decomposi- 
tion [10], which uniquely factorizes any 2n x 2n symplec- 
tic matrix S as the product of 3 special matrices: 
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where B + iF is & n x n unitary matrix, D is diagonal 
with strictly positive components, A is lower triangular 
with all diagonal terms set to 1, and A^C is symmetric. 

In our study, we consider 3 modes, depicted in Fig. [T] 
The first one, noted B' is send from Alice to Bob, who 
performs an heterodyne measurement upon reception. 
Eve makes this mode interact with two ancillary modes 
El and E2 initially in the vacuum state, and then mea- 
sures X ow El, and P on E2. To respect the symmetry 
of this problem, we only consider symplectic transforma- 
tions S that do not mix X and P quadratures: 



S ^ 



Sx 
Sp 



(5) 



As B, D and A are invertible, expanding S yields F = 
C = 0, and B orthogonal. We recall that the columns 
of the orthogonal matrix B, as well as its rows, form an 
orthonormal basis. With this form, the Iwasawa decom- 
position has a physical meaning in terms of linear optical 
components. Namely, any symplectic transformation is 
composed of an orthogonal transformation which is it- 
self a composition of rotations (i.e. beam-splitters) and 
reflections (i.e. 7r-phase shifts), 1-mode squeezers, and 
feed-forward. 

Finally, we can write the Iwasawa decomposition cor- 
responding to our attack model: 
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with S = ac — h. The orthogonal matrix B can be pa- 
rameterized by 3 real parameters (Euler angles) plus a 



binary parameter (the sign of the determinant). This 
leaves 9 real and one discrete symplectic parameters to 
characterize the matrix S. By expanding S and using 
orthogonality properties of B, we can express channel 
parameters as functions of these symplectic parameters: 



Tx = tx with tx = = sihi 
Tp = t^p with tp = 54.4 = — 
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We note that si and hi are equivalent to channel pa- 
rameters Tx and Xx- As we are looking for the best 
attack for given channel parameters, we will consider Si 
and hi fixed. Our attacks are then characterized by 7 
real and one discrete parameters. 

The input covariance matrix 7* is diagonal with di- 
agonal terms (F, 1, 1, V, 1, l)A^o- The output covariance 
matrix is expressed as 7 = S-f^S"^. From S and 7, we 
obtain Eve's noises and conditional variances 
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i)(x. 



r^ + l {V + x.^MXp.^+1) 



Pb'\Pe2 







74,4 



_ 74,676,4 
76,6 

1 iVX.B. 



1)(X. 



iV + XPB,)iXx,^+l) 

where r = asi/s2. AH these quantities only depend on 
parameters r and 64: our parameter space drops to 2 
parameters. 

Then, we will require that the attack leaves channel 
parameters symmetric in X and P, i.e. Tx = Tp = T 
and Xx = Xp = X- The former relation univocally fixes 
<^ = 53(61 (sf — l)/si -I- 064/52)767, and the later fixes r: 



hMl~sl)+a^il-bl-hi)p 
I -hi 



(9) 



where a = ±1 and p = {si - 1)(1 - s?(26? - 1)). In 
terms of channel parameters, p — {Tx)^ ~ (1 ~ TY. For 
a symmetric channel, the Heisenberg inequality requires 
that p > therefore r is well defined for any attack 
that can be made symmetric. Finally, we are left with 
only one parameter, 64, such that 64 < 1 — 6f = x/(l + x)) 
and the sign a. 
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For RR, the information Eve acquires is given by 



Ibe = X log2 . 

Z \ V' 



Vb 



1, Vb 



V, 



Pb\Pe2 



Ibe is maximum when {Vxg,\XE^ + 1)(^Pb/|Pe2 + 1) is 
minimum. For direct reconcihation (DR), for which the 
key is distiUed from Ahce's data, the information Eve 
acquires is given by the Shannon formula: 



1 V + x. 

IaE = ^ log2 — 

2 \ 1 + Xx 



1 V + x 



We find that both mutual informations Iae and Ibe 
have an extremum at 



b, = a (10) 

We check numerically that in the quantum regime de- 
fined by e < 2, this extremum is indeed the absolute 
maximum. For this value of 64, we compute Eve's noise 
and conditional variance as functions of channel param- 
eters: 



T(2-e)2 



(V2 -2T + Te + V^)2 



1 (11) 



These expressions form the new bounds for direct and 
reverse reconciliated heterodyne protocols. As they are 
obtained for the same value of 64, any attack that reaches 
bound pT|) (i.e. optimal for DR) also reaches bound 
(i.e. optimal for RR). 



IV. APPLICATION TO THE HOMODYNE 
DETECTION PROTOCOL 

In this section, we will show that bound ([T]) on the 
homodyne protocol can also be derived from the Iwa- 
sawa symplectic decomposition. In the homodyne pro- 
tocol, Eve stores the quantum states of mode Ei and 
mode E2 in quantum memories, waiting for Bob's mea- 
surement basis disclosure. After this. Eve can measure 
the same quadrature Q — X or P chosen by Bob on 
both modes. The information acquired by Eve in the RR 
homodyne protocol is deduced from the conditional vari- 
ance on Bob's measurement knowing the quadrature Q 
of modes Ei and E2, which can be computed from the 
output covariance matrix 7: 



Vc 



Qb'IQe 



det(7Q) 
det(7£;) ' 



(13) 



where jq is the restriction of 7 to the quadrature Q, and 
7e is the restriction of 7 to the quadrature Q of Eve's 



modes Ei and E2 ■ By expanding the Iwasawa decompo- 
sition of the symplectic transformation 5* decribing the 
attack, and by using orthogonality properties of matrix 
B, we can express this conditional variance as: 



V 



Qb'\Qb,,qe^ TQ,(yxQ' + i) 



Nn 



(14) 



where Q' = -P or A" is the quadrature not measured by 
Bob. This conditional variance coincides with the homo- 
dyne bound (U)). It is important to note that contrary 
to the heterodyne conditional variance which depends 
on symplectic parameters r and 64 as shown by equa- 
tions ([5|), the homodyne conditional variance (fTil) only 
depends on channel parameters, but no other symplectic 
parameter characterizing the attack 

The DR case is treated similarly, by considering the 
covariance matrix 7"^^ that gathers the modulation value 
chosen by Alice {Xa,Pa) and modes Ei and E2 owned 
by Eve. By expanding the Iwasawa decomposition of S, 
we find 



Vc 



QaIQei ■,Qe2 



which yields 



det(7^^) _ {y-l){l+x<,') 



det(7i 
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V + xf"" 
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with = 1/ Xq' ■ This expression matches the highest 
bound for the information acquired by Eve in the DR 
homodyne protocol established in [l^. It depends only 
on channel parameters, and not on the other symplectic 
parameters. 

Therefore, we have shown any attack against the DR 
or RR homodyne protocols 

1. that do not mix quadratures X and P 

2. that can be performed with two ancillary modes 

3. in which all ancillas are initially vacuum states 

4. in which Eve measures the same quadrature as Bob 
on all of her ancillary modes with the help of quan- 
tum memories 

is optimal for the channel parameters it can reproduce. 
In particular, the entangling doner attack introduced 
in T| and the assymetric cloning attack studied in Q 
are optimal homodyne attacks ; for channels with no ex- 
cess noise (e = 0), the beam-splitting attack is optimal. 
Equations (fT4| and (fT5|) show that the optimality of any 
attack that verify conditions 1-4 holds even for attacks 
yielding dissymmetric channel parameters (i.e. Tx =/= Tp 
and Xx ^ Xp)- 

In fact, conditions 1-3 do not hamper the generality 
of the attacks we consider. Indeed, condition [T] is not 
restrictive as one can reduce any symplectic matrix to 
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the block diagonal form ([5]) by means of local Gaussian 
operations [13]. We will see in section IVlIl that numerical 
simulations show that condition [2l is in fact not neces- 
sary. Finally, condition [31 is also not restrictive because 
one can include the preparation of a non-vacuum initial 
state from vacuum states inside the symplectic transfor- 
mation describing the attack, eventually by making use 
of extra ancillary modes. 

The fact that the heterodyne attack scheme breaks 
condition [H is the reason why, in general, the hetero- 
dyne bound is higher than the homodyne bound ([T|), 
thus imposing more stringent constraints on Eve's infor- 
mation. However, for some particular values of the chan- 
nel parameters, these two bounds coincide. Namely, this 
happens when x = \/l - T + T /V^ /T - l/V for RR. 
For DR, bound (jlip is equal to its homodyne counterpart 
^hom = when X = ^/Y^^TJt with T > 1. For these 
channel parameters, an optimal heterodyne attack is also 
an optimal homodyne attack, but without the need for 
quantum memories, therefore lowering the technological 
requirements for the eavesdropper. 

We recall that like all the results presented in this pa- 
per, the optimality of any homodyne attack is to be un- 
derstood in the context of individual Gaussian attacks. 
However, since the homodyne bound ([1]) is proven secure 
against the larger class of individual and finite-size Gaus- 
sian and non-Gaussian attacks 0, we can say that any 
Gaussian individual attack that fulfills conditions 1-4 is 
optimal among that extended class of attacks. Security 
proofs of the homodyne protocol against collective at- 
tacks require the use of the Holevo entropy 0, 01 , then 
the results presented here do not apply to this general 
class of attacks. 



V. PROOF BASED ON SYMPLECTIC 
INVARIANTS 

It is possible to derive the heterodyne bound 
from another technique that does not require the Iwa- 
sawa decomposition. This technique is based on the fact 
that the output covariance matrix 7 issues from some 
symplectic transformation S applied to the initial co- 
variance matrix 7*. Since 7' is diagonal with diagonal 
terms (V, 1, 1, V, 1, 1)A^07 this property simply states that 
(y, 1, l)A'o are the symplectic eigenvalues of the output 
covariance matrix 7. In other word, finding the best at- 
tack for RR amounts to minimizing the conditional vari- 
ance of Bob's measurement knowing Eve's measurement 
over the set of covariance matrices with symplectic eigen- 
values {V, 1, \)N^. In terms of symplectic transforma- 
tions, Heisenberg relations on the three modes we con- 
sider require that all symplectic eigenvalues are greater 
than Nq. Therefore, covariance matrices with eigenval- 
ues (y, 1, l)A'o are covariance matrices that are compat- 
ible with Heisenberg relations and an input modulation 
of variance VNq . 

Since symplectic eigenvalues are usually hard to ex- 



press analytically, we will rather use symplectic invari- 
ants, which are totally equivalent to symplectic eigenval- 
ues. For a three mode state, there exist three symplectic 
invariants Aj_3 with j = 1, 2, 3 defined as the sum of the 
determinant of all 2j x 2] sub-matrices of 7 which diag- 
onal is on the diagonal of 7 [l4| . Applied to the input 
covariance matrix 7', these invariants read 
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We will now express the symplectic invariants as func- 
tions of the components of the output covariance matrix 
7. For this purpose, we write this matrix as 



(19) 



where m stands for "measured" and n for "not mea- 
sured", and Vb' = T{V + x)- This notation assumes 
that the attack does not mix quadratures X and P, and 
that swapping measurements of modes Ei and E2 would 
not change Eve's information. The later assumption is 
backed by results of section IIIII where we found that the 
optimal heterodyne attack yields to equal variances for 
X and P measurements. From equation (jl9p we can 
compute symplectic invariants as 



Ai,3 
A2,3 

A3,3 



2c^ + Vl, +4:X + 2y 
c* + 2cV|, + ic^x - AcVb'X + 4a;2 
+2Vb'V + '^xy + ?/ - 4cz - 2Vb'Z 
{-2cx + Vb'{c^ -y) + zf, 



where we introduced variables 

X^CmCn, y^VEmVEn, Z ^ VEmC^ + VeuC^. 

With these variables. Eve's conditional variance yields 
/ ^2 



VEn 







Since ?/ > 0, we will only consider a' — 1 because it 
gives more information to Eve. Using the invariance of 
symplectic invariants, we uni vocally fix x and z 



\ (2(1 -c'-y) 

Vs'y -V- c\Vb' +c)+'- [2(1 - + y2 _ yj,] ^ 
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as well function of channel parameters 

V-Vb' 



(20) 



Consequently, the heterodyne conditional variance Vb'\e 
only depends on channel parameters and y. Then, we 
notice that y appears in the homodyne conditional vari- 
ance 



yB'\Ei.E2 



V 



(21) 



Therefore, the homodyne bound ([1} contraints y by 

c2 <y < c2+T(V^X + l) (22) 

We numerically find that Vb'Ib is a decreasing function 
of y, therefore the highest value for y must be considered 
to bound Eve's information. In fact, using the results 
of section IIVI stating that any attack on the homodyne 
protocole is optimal (the covariance matrix fulfills 
conditions 1-4), we can say that the only possible value 
for y is indeed + T{Vx + !)■ Now, Vb'\e only depends 
on channel parameters, and we can check that it coincides 
with bound (fH)) . 

In conclusion, we have shown another technique for de- 
riving bound (|12p . This technique is slightly less general 
than the Iwasawa decomposition because it assumes that 
the optimal attack respects the symmetry of the prob- 
lem. Furthermore, it does not cover the DR protocol. 
Yet, it enables to find bound ^2]) from more fundamen- 
tal Heisenberg-like properties. 



VI. OPTIMAL ATTACKS 

We shall now exhibit four optimal attacks against the 
heterodyne protocol with repect to bounds pTjl and 
depicted in Fig.O The existence of such optimal attacks 
show that the bounds we derived are tight: it is not pos- 
sible to further reduce the estimation Alice and Bob can 
make about Eve's information. The first optimal attack 
we consider is the feed forward attack introduced in 
The symplectic matrix associated with this attack is 
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and Sp is obtained from by replacing the first line 
in the leftmost matrix by [1, 0, —gE]- Using equations ([7|) 
which link coefficients of the symplectic transformation 
matrix to channel parameters T and e, we can see that to 
faithfully reproduce these channel parameters. Eve must 
choose: 



9e = <^T, Te 



,2- Ve(2-2T + Te)) ^ (2 - e) 



{2 + Tty/T 



(2 + Te) 



With these parameters, we can check from the compo- 
nents of S^^ injected in equations fS]) that this attack 
reaches bounds PT|) and 

Quantum teleportation is represented by the symplec- 
tic matrix 
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Here, 



Sp is obtained by using [1, 0, gE] as the first line of 



the leftmost matrix, and changing s — + 1/s. The second 
from left matrix simply swaps the 1st and 3rd modes to 
respect our mode order convention. Channel parameters 
fix s and gE- 



g%^2T, s^ = 



1-T + Te- ^Te{2 - 2T + Te) 

(1 - Vr)2 



and noise computation shows that this attack is optimal. 

Then, the entangling doner attack is represented by 
the symplectic matrix 
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To fake channel parameters. Eve must choose 

-4 + 1 Te 



Te — T and 



2s' 



l-T 



1 



Once again, noise and conditional variance computations 
from the components of this matrix yield bounds (jlip 
and (fT2|l. 

Finally, the cloning attack studied in [Sj is also op- 
timal. This can be checked by verifying that the con- 
ditional variance of equation (44) in coincides with 
bound p^ . For this attacks, the authors show that in 
order to reproduce channel parameters. Eve must choose 



Te = T{1 - e/2) and G = 



1 



1 - e/2' 



For no excess noise (e = 0), all these attacks are equiv- 
alent to beam-splitting attacks. 



VII. DISCUSSION 

We first discuss the generality of the model shown on 
Fig-Ql on which we built our proofs. This model assumes 
that Eve's attack only involves two modes, but one can 
imagine that Eve could use and measure more modes, 
also carrying some information about Alice and Bob's 
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FIG. 3: Effective information rate for typical experimental 
parameters: V — 11, e = 0.02 and a perfect error correction 
/3 = 1 (top) or a constant reconciliation efficiency /? = 0.87 
(bottom). The new bound on heterodyne protocol provides 
more secret information than the homodyne protocol or the 
previous heterodyne bound. We can see from the bottom 
graph inlet that with these parameters, the new heterodyne 
provides secret information for every channel transmission. 
However, in practice, the reconciliation efficiency j3 drops as 
the distance rises, then limiting the range of the protocol. 



transmission. To tackle this problem, we can imagine 
that Eve concentrates all the information her modes bear 
into a single mode for each quadratures, by iterative con- 
structive interferences between her modes using beam- 
splitters. Since local operations using beam-splitters on 
Eve's modes do not alter the conditional variance Vb'\ei 
any attack on n modes for each quadrature X and P can 
be mapped to an equivalent attack, where Eve only needs 
to measure one mode for each quadrature. Therefore, it 
seems reasonable to assess that it is useless for Eve to 
introduce extra modes that in the end do not provide 
any information about Alice and Bob's data. This tech- 
nique is illustrated in ,9] , where the authors consider the 
interference of the two modes owned by Eve in the assy- 
metric attack against the homodyne protocol, and show 
that this interference enables Eve to measure only one 
mode without loosing information. 

To back this argument, we performed numerical sim- 
ulations that give 2ri modes to Eve, with n = 1,2,5. 
In these simulations, 10'' attacks are tested by generat- 



ing random symplectic transformations parameterized by 
the Iwasawa decomposition. It shows that the two main 
results of this paper hold with more that two modes for 
Eve, namely that any attack using quantum memories on 
the homodyne protocol is optimal, and that the informa- 
tion Eve can get on the heterodyne protocol is bounded 
by Ca). 

We complete our study by discussing practical ad- 
vantages of the heterodyne scheme over the homodyne 
scheme, when considering that a classical error correction 
with limited efficiency P has to be applied to experimen- 
tal data to obtain a secret key [lH|- In this picture, the 
practical key rate becomes A/off — (31 ab — Ibe, result- 
ing in a bit loss of A/ — AI^s = (1 — P)Iab- Because for 
a given efficiency (3 the mutual information Iab of the 
heterodyne scheme is higher, this protocols suffers from 
greater key loss than the homodyne scheme. When con- 
sidering bound (P), this loss was rapidly fatal. However, 
with the new bound (HH), we can see from Fig. [3] that the 
heterodyne scheme recovers its advantage. 

Still, there are two other practical drawbacks to the 
heterodyne protocol. First, for a given distance, the sig- 
nal to noise ratio (SNR) of the transmission is lower be- 
cause of Bob's heterodyning beam-splitter. Since the rec- 
onciliation efficiency is an increasing function of the SNR, 
this effect lowers the final key rate. Because of this, both 
heterodyne and homodyne protocols feature an equiva- 
lent key rate. For example, for T = 0.25 (corresponding 
to 25 km), e ~ 0,02 and V ~ lliVo [11], the homodyne 
scheme achieves (3 — 0.87 and the heterodyne scheme 
(3 = 0.80, both yielding to a few 0.01 bits per symbol. 
Second, Alice and Bob need to reconcile twice as much 
data as for the homodyne case. This effect also low- 
ers the final key rate when, as experimentally observed, 
computing speed limits the experimental repetition rate. 
However, on-going work on reconciliation at low SNR 
may take advantage of the high effective key rate of the 
heterodyne protocol. 

In conclusion, we have derived new bounds for individ- 
ual attacks on the direct and reverse reconciliated QKD 
protocols with heterodyne detection. These new bounds 
offer a higher secret key rate than previous bounds. We 
have shown that the feed-forward attack, the cloning 
attack, the quantum teleportation and the entangling 
doner all achieve these bounds, then closing the gap be- 
tween best known bounds and best known attacks. On 
the other hand, the behaviour of these new bounds with 
respect to non-Gaussian and collective attacks [1, Q 
remains an open question. 
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